Variable Issue after upgrade to Elasticsearch 7.1 - Query finds no values - Solved

Grafana Elasticsearch
1

I have a simple dashboard that pulls a hostname as a variable from an Elastic Index. This used to work on Elastic 6.7, but i’ve had a number of issues since upgrading to 7.1. I’ve upgraded Grafana to 6.3.0 and my datasource looks ok. It gets Index OK, Time field name OK when I save and test it.

My problem now is that the variables on the dashboard don’t find any results. There is no error.

GrafananoVariableFound
GrafananoVariableFound1600×798 61.2 KB

If I hardcode the vsphere.host.name into a panel then it works as expected (i.e. it finds the value and displays it correctly on the graph.)

Here is some example data from within the specified index.

ElasticData
ElasticData1600×902 240 KB

Can anyone explain why the variable preview finds no values? Has the syntax changed or have I missed something obvious!?

Thanks

2

Have you changed version in datasource configuration to 7.0+?

3

Yes datasource is set to 7.0+.

ElasticDataSourceOK
ElasticDataSourceOK1600×578 38.2 KB

4
  1. Please make sure that you’re using a time range in dashboard that has terms
  2. Use chrome developer tools and check the console for errors and network tab _msearch request/response of your terms variable query.
5

Ok that was helpful thanks.

I could see the below error

“Fielddata is disabled on text fields by default. Set fielddata=true on [vsphere.host.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.”

Setting fielddata to true does fix the problem. On a side note this index is the default one that metricbeat 7.1 creates. I’m not sure if changing this setting won’t have other implications. It might need some tweaking!

Thanks again.